Completing your HIPAA Security Risk Assessment (SRA) before the end of the year
Let’s be honest, if you are reading this, you probably still have “complete your HIPAA Security Risk Assessment (SRA)” on your to-do list and you are wondering what you can do to get it done before the end of the year. (December 31st is right around the corner) We understand procrastination, but we also understand the importance of HIPAA compliance and the key reasons behind completing an SRA. Meaningful use programs such as MACRA and MIPS require a risk assessment to be completed on an annual basis, and failure to do so will GUARANTEE that you lose most of if not all your payment adjustment. Even if you don’t care about meaningful use, you will certainly care about the fines and penalties from the OCR for failure to complete an SRA when you are inevitably breached. The HIPAA/MIPS SRA completion deadline is December 31st. But for those who haven’t even started, is it still possible to meet the deadline with a quality security risk assessment? Let’s first talk about the critical steps to completing an SRA and how to navigate each one.
- Information Gathering – The first step is to gather the necessary information within the scope of the assessment. This involves communicating with individuals responsible for certain systems and processes to make sure that there are security and HIPAA controls in place at the organization. The list of relevant individuals includes HIPAA Compliance Officers, IT, HR, and more. But tracking down these individuals and collecting the requisite policy and procedure information can be tough to do on your own.
- Analysis – This is where automation really comes in handy. After gathering the necessary information, it’s time to cross reference your results with HIPAA citations and security controls to determine if there are gaps in your compliance. This is the bona fide “assessment” part of the process. Ideally, a final report prioritizing compliance gaps and security concerns will be generated (not an easy thing to produce on your own). After the analysis is complete, if you can wrap your head around and identify your compliance gaps, you need to start planning for remediation.
- Planning and Remediation – HIPAA compliance is a bit of a moving target, and no organization is perfectly HIPAA compliant at any given moment. When compliance and security gaps are discovered, they should be broken down into remediation items, or tasks that must be accomplished to address said gaps. Don’t worry, when you have completed a security risk assessment and a remediation plan is in place, you are considered “HIPAA compliant”, so long as you follow through on your remediation and action plan throughout the next calendar year. HIPAA compliance is all about showing that you are putting your best effort in to making your organization and specifically health information more secure. A proper remediation plan should include specific tasks, completion deadlines, and assignees for each remediation item. Organization and accountability are key. Friendly, automated reminders are helpful too.
This seems like a lot, right? Correct, it is actually TOO much to do on your own in a single month. But lucky for you, Intraprise Health’s HIPAA One® software is an automated solution designed to help you do just that! Let’s touch back on each of the above critical SRA steps and explain how the HIPAA One® software can help you accomplish each with minimal effort from you and your team.
- Information Gathering – The HIPAA One software gathers the necessary assessment information through a series of interview questions prompting you to answer a “yes or no” question. Each of these questions tie back to one or more HIPAA citations. We have taken the time to whittle down each and every dull and confusing HIPAA citation required by the OCR (we even left them in, in case you like reading those things) into a simple question. You can assign delegates (specific people) to sign into the software and answer groups of questions relative to their role, like IT-specific questions to IT individuals. Example Question: When responding to survey questions, you have three options. If you answer “yes”, you must provide proof by uploading a policy and procedure (these will be reviewed later to determine if they are adequate). If you answer “no”, no big deal, we will provide you with a policy and procedure template which you can edit to your liking and specific circumstances. If you answer “not reasonable or appropriate for our circumstances” you will need to provide a brief explanation. The HIPAA One® dashboard allows you to check the progress of interviews and the delegates assigned to each.
- Analysis – After we have gathered the necessary information, the software does its magic and you can sit back and enjoy the show (well actually there is nothing to watch because the analysis happens in just a few seconds, but go ahead and take a well-deserved break anyway). The analysis will bring back a report identifying compliance and security gaps with a risk score associated with each, helping you understand where your risks are and how to prioritize and then address them.
- Planning and Remediation – As part of your final report generated by the software, you can visualize each of your gaps and create remediation tasks to address them. The software allows you to assign tasks to individuals and set deadlines and automated task reminders. Instructions and updates can be typed next to each task to help you better coordinate and communicate across the organization. Remediation Plan Example:
Despite what you may be thinking, it is NOT too late to complete your HIPAA Security Risk Assessment. With a little help, you can be done before the holidays. HIPAA compliance is boring and time consuming, but it doesn’t have to be. Don’t wait any longer, contact us now to get started.